Cross-Session Reasoning Object Replay Vulnerability in OpenAI, Anthropic, and Google Reasoning APIs

Technical Analysis

The vulnerability lies in the encrypted 'reasoning object' mechanism used by reasoning-capable LLM APIs to persist hidden chain-of-thought state across multi-turn or multi-call sessions without exposing raw reasoning tokens to clients. Researchers found these encrypted blocks were not strictly bound to their originating session/context, enabling replay of a reasoning object generated in one session into a different session or even a different (weaker) model, which could then partially decode or leverage the embedded reasoning content. During testing, this replay path leaked secrets that had been present in prior session logs, including API keys and passwords, indicating insufficient session-scoping, weak binding of ciphertext to session identity/nonce, and/or logging of sensitive plaintext into reasoning traces. No public CVE has been assigned as of this report. For organizations running AI agents or LLM-based tool-use pipelines, this flaw is directly relevant: agents that pass reasoning tokens between calls, cache reasoning state, or log session transcripts containing credentials (API keys, tokens, passwords) risk cross-session credential exposure or reasoning-content leakage to less-trusted models or third parties.

Affected Systems

OpenAI reasoning API (o-series/reasoning models using encrypted reasoning objects), Anthropic Claude reasoning/extended-thinking API, Google Gemini reasoning API; any agent frameworks, RAG pipelines, or orchestration layers that persist or replay encrypted reasoning tokens across API calls or sessions

Indicators of Compromise

• No file-based or network IOCs applicable; this is an API-level logic flaw rather than malware-based intrusion

Remediation Steps

1. 1

   Apply vendor patches

   Monitor OpenAI, Anthropic, and Google security advisories and apply any patched SDK/API updates addressing reasoning object session binding as soon as released.

2. 2

   Rotate exposed credentials

   Rotate any API keys, passwords, or tokens that may have appeared in session logs, prompts, or reasoning traces processed through affected reasoning APIs.

3. 3

   Audit agent logging practices

   Review AI agent and RAG pipeline configurations to ensure secrets are never embedded in prompts, tool outputs, or reasoning traces that could be persisted, cached, or replayed.

4. 4

   Restrict cross-session reasoning reuse

   Disable or restrict any custom implementation that caches or replays encrypted reasoning objects across sessions or model instances until vendor confirms proper session binding.

5. 5

   Implement secrets management

   Use vaults or secret managers instead of passing raw credentials through LLM context windows, tool calls, or agent memory to reduce exposure if similar flaws recur.